Non notée
CVE-2021-40110 In Apache James, using Jazzer fuzzer, we identified that an IMAP user can craft IMAP LIST commands to orchestrate a…
Description
In Apache James, using Jazzer fuzzer, we identified that an IMAP user can craft IMAP LIST commands to orchestrate a Denial Of Service using a vulnerable Regular expression. This affected Apache James prior to 3.6.1 We recommend upgrading to Apache James 3.6.1 or higher , which enforce the use of RE2J regular expression engine to execute regex in linear time without back-tracking.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache James 3.6 | premières → 3.6.0 | Pas de correctif indiqué |
Références
- www.openwall.com www.openwall.com
- [oss-security] 20220104 CVE-2021-40110: Apache James IMAP vulnerable to a ReDoS www.openwall.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Apache James
Les 7 CVE de Apache James →
CVE-2022-28220
Apache James prior to release 3.6.3 and 3.7.1 is vulnerable to a buffering attack relying on the use of the STARTTLS…
Non notée
CVE-2022-22931
Fix of CVE-2021-40525 do not prepend delimiters upon valid directory validations
Non notée
CVE-2021-40525
Apache James ManagedSieve implementation alongside with the file storage for sieve scripts is vulnerable to path…
Non notée
CVE-2021-40111
In Apache James, while fuzzing with Jazzer the IMAP parsing stack, we discover that crafted APPEND and STATUS IMAP…
Non notée